f40fdc94d6692812e7ad056d5c5b5a7c212baa7abff156ed1de0b2a3bf17f2dc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 07:15

Target

Miranda IM/Icons/proto_YAHOO.dll
Size

23KB
MD5

e2eba3885a11c6e5a4fdae00710ad0e5
SHA1

b97a57fa0455f1b4b237c78bf363182622a9a7e5
SHA256

619e3bfbf4707369558dc8385befa4de83d6cab34164907385fcead3caf75137
SHA512

5ca31eb3a8a712e84480c72bb41584f14776caef9b5480a946853dd3f2654465dae6176f60441d6d6f2de14d319b9a7f7a2fa719ec59110c3eac2181a6bb99c9
SSDEEP

384:o5fWjIiZ6w62BbFttZtqdiTJCKUieTZMPq1L3Bbo8BeJX1v/1e:okh7ttZtqdiwlieTZMPq1L3lH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 2168	4592	rundll32.exe	87
PID 4592 wrote to memory of 2168	4592	rundll32.exe	87
PID 4592 wrote to memory of 2168	4592	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Miranda IM\Icons\proto_YAHOO.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Miranda IM\Icons\proto_YAHOO.dll",#1
  2⤵
  PID:2168